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Amendments to the Claims: 

Please note the insertion of terms "t allow", "tno Jilter", "t _pr event", 
"t_open", "t_DD", "t_bad Jrom", "t suspect domain", "t_echo_domain", 
"t to Jrom", "t Jbrged_domain", "sender address" and "DD0" have underscores 
which may not be visible with the underlining. 

This listing of claims will replace all prior versions, and listings, of claims in the 
application: 

Listing of Claims : 
Claims: We claim: 

1) (Currently Amended) An unsolicited message rejecting communications processor 

connected to 

message transfer agents 

MTA_0 with an Internet address of IP_0, from address sender address A_0, declared 

domain of D O, and actual real domain of DD 0, and 

MTA_1 with an Internet address of IP 1 and to address recipient A_l 

comprising: 

a) monitoring means for monitoring the communications between MTA0 and 
MTAl; 

b) determining means for determining if the communications contains an unsolicited 
message; and 

c) intercepting means for intercepting a RCPT command from MTA0 and sending 
an error reply to MTA0 if the message is determined to be unsolicitedff.]^ 
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whereby MTAl controls the interaction between MTA 0 and MTAl before a RCPT 
command from MTA_0 is received by the unsolicited message rejecting communications 
processor and 



whereby the connection with MTA 0 is rejected by the intercepting means before the 
data portion of the unsolicited message is transmitted. 

2) (Currently Amended) The unsolicited message blocking rejecting communications 

processor in Claim 1, further includes [[a]] an allow address database and wherein 
the determining means determines if a message is not unsolicited by checking if the 
IP_0 is in the allow_address database. 

3) (Currently Amended) The unsolicited message blocking rejecting communications 

processor in Claim 1, further includes a prevent_address database and wherein the 
determining means determines if a message is unsolicited by checking if IP_0 is in 
the prevent_address database. 

4) (Currently Amended) The unsolicited message blocking rejecting communications 

processor in Claim 1, further includes access to a open relay database and wherein 
the determining means determines if a message is unsolicited by checking if IP O is 
in the open relay database. 

5) (Currently Amended) The unsolicited message blocking rejecting communications 

processor in Claim 1, further includes access to a DNS (domain name server) 
database and wherein the determining means determines if a message is unsolicited 
by checking if IP O has a domain name entry DD 0 in the DNS database. 

6) (Currently Amended) The unsolicited message blocking rejecting communications 

processor in Claim 1, further includes a bad from database and wherein the 
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determining means determines if a message is unsolicited by checking if the from 
address sender_address A O is in the bad from database. 

7) (Currently Amended) The unsolicited message blocking rejecting communications 

processor in Claim 1, further includes a suspectdomain database and wherein the 
determining means determines if a message is unsolicited by checking if the actual 
real domain DD 0 matches the domain of from address senderaddress A O and the 
domain of from address sender address A O is in the suspect domain database. 

8) (Currently Amended) The unsolicited message blocking rejecting communications 

processor in Claim 1, wherein the determining means determines if a message is 
unsolicited by checking if the from address sender address A O matches the te- 
addross recipient (A_l). 

9) (Currently Amended) The unsolicited message blocking rejecting communications 

processor in Claim 1, further includes a no_filter database and wherein the 
determining means determines if the message is to be blocked if it is determined to 
be unsolicited by checking if the recipient A_l is in the no filter database . 

10) (Currently Amended) The unsolicited message blocking rejecting communications 
processor in Claim 1, wherein the determining means determines if a message is 
unsolicited by checking if the declared domain D O of MTA 0 is the same as the 
domain D_l ofMTA l. 

11) (Currently Amended) The unsolicited message blocking rejecting communications 
processor in Claim 1, wherein the determining means determines if a message is 
unsolicited by checking if the declared domain D O of MTA 0 does not match the 



Page 6 of 30 



Application No. 10/761,883 

Reply dated February 29, 2008 

Reply to Office Action of October 31,2007 

real domain DD I DP 0 and the declared domain D O is in the suspectdomain 
database. 

12) (Currently Amended) The unsolicited message blocking rejecting communications 
processor in Claim 1, further includes a rejected connection database which logs the 
time, from address sender address A O, to address recipient A_l, and the reason for 
the rejection if a message is rejected if the message is determined to be unsolicited. 

13) (Currently Amended) The unsolicited message blocking rejecting communications 
processor in Claim 1, further includes [[a]] an allowed connection database which 
logs the time and to address recipient A_l if the message is determine not to be 
unsolicited. 
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14) (Currently Amended) A method for 

a receiving networked computer system with an Internet connection, a mail 
transport agent MTAl, an Internet address IP 1, to address recipient A_l, and 
an operating system capable of executing the method 
to reject unsolicited messages from 

a transmitting networked computer system with an Internet connection and a 
message transfer agent MTA 0, an Internet address IP O, from address 
sender address A O, declared domain D O, and actual real domain DD 0 
comprising the steps of: 

a) waiting for a new SMTP connection request; 

b) relaying and monitoring the replies from MTA_0 to MTA_1 ; 

c) relaying replies from MTA_1 to MTA_0; 

c') allowing MTA l to control the interaction between MTAO and MTA l until a 
RCPT reply is received from MTAO; 

d) intercepting the RCPT reply from MTA O to MTA l; 

e) determining if the message is unsolicited by analyzing the monitored replies; 

f) releasing the intercepted RCPT reply if the message is determined not to be 
unsolicited; and 

g) sending [[a]] an error reply to MTA O if the message is determined to be 
unsolicited; and 

h) rejecting the connection with MTA O before the data portion of the unsolicited 
message is transmitted if the message is determined to be unsolicited. 
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whoroby MTAl controls tho interaction botwoon MTA0 and MTAl until a RCPT 
command is rocoivod from MTA0 and 

whoroby tho connection with MTA0 is rojoctod before - tho data portion of tho 
unsolicited message is transmitted. 



Page 9 of 30 



Application No. 10/761,883 

Reply dated February 29, 2008 

Reply to Office Action of October 31, 2007 

15) (Currently Amended) A method for 

a receiving networked computer system with an Internet connection, a mail 
transport agent MTAl, IP address IP 1, a domain name D 1, a recipient, 
A_l, an allow_address database, a prevent_address database, a 
suspect domain database, a bad from database, a no filter database, a 
rejected connection database, an allowedconnection database, and an 
operating system capable of executing the method 

to reject unsolicited messages from 

a transmitting networked computer system with an Internet connection, a 
message transfer agent MTA_0, an IP address of IP O, a declared domain 
name D_0, a real domain name DD_0, and a sender address of A_0 

comprising the steps of: 

a) waiting for a SMTP connection request on the receiving networked computer 
system's Internet connection; 

b) sending a 220 reply to MTA 0 to acknowledge the requested connection; 

c) extracting IP address IP O from the connection request; 

d) testing if the DNS database has a domain name DD 0 for IP O; 

e) testing if IP O is in an open relay database; 

f) testing if IP O is in the allow address database; 

g) testing if IP O is in the prevent address database[[,]]; 

h) requesting a connection with MTA l ; 

i) waiting for a 220 reply from MTA l to acknowledge the requested connection; 
j) waiting for a reply from either MTA 0 or MTA l ; 
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k) jumping to step n) if the reply is not from MTA l ; 

1) relaying the reply from MTA l to MTA0; 

m) jumping to step j) to wait for a new reply; 

n) jumping to step t) if the reply from MTA 0 is not a HELO; 

o) extracting domain D O from the reply; 

p) testing if declared domain DO of MTA0 matches domain D_l of MTAl; 

q) testing if declared domain D O does not match real domain DD 0 of MTA 0 

AND declared domain D O is in the suspectdomain database; 
r) relaying the HELO reply from MTA 0 to MTA l ; 
s) jumping to step j) to wait for a new reply; 
t) jumping to step z) if reply from MTA_0 is not a MAIL; 
u) extracting from address sender address A_0; 
v) testing if A_0 is in the bad_from database; 

w) testing if DD 0 does not match the domain of A_0 and the domain of A_0 is in 

the suspect domain database; 
x) relaying MAIL reply to MTA_1 ; 
y) jumping to step j) to wait for a new reply; 
z) jumping to step kk) if reply from MTA 0 is not a RCPT; 
aa) extracting to - addrcss recipient A_l; 
bb) testing if A_l is in no filter database; 
cc) testing if A O matches A_l; 
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dd) jumping to step hh) if NOT(t_allow OR t no filter OR NOT ( t_prevent OR 
t open OR t_DD[[-]]) OR t bad from OR t suspect domain OR t to from OR 
t echo domain OR t_forged_domain)[[)]] ; 

ee) logging time and to address recipient A_l in the allowed_connection database; 

ft) relaying RCPT reply to MT A_ 1 ; 

gg) jumping to step j) to wait for a new reply; 

hh) logging the time, from-address sender_address A_0, to address recipient A_l, 
and the reason for rejecting the connection in the rejected connection database; 
ii) rejecting the connection to MTA 0 by sending a 550 reply to MTA 0; 
jj) jumping to step j) to wait for a new reply; 
kk) jumping to step w) if reply from MTA_0 is not DATA; 
11) relaying DATA reply to MTAl ; 
mm) waiting for a 354 reply from MTA l; 
nn) relaying the 354 reply from MTA l to MTA 0; 
oo) waiting for the data from MTA 0; 
pp) relaying the data from MTA 0 to MTA l ; 
qq) waiting for a Ar\n from MTA_0; 
rr) relaying the Ar\n from MTA_0 to MTA_1 ; 
ss) waiting for a 250 reply from MTA_1 ; 
tt) relaying the 250 reply to MTA 0; 
uu) jumping to step j) to wait for a new reply; 

w) jumping to step yy) if reply from MTA 0 is not RSET, SEND, SCML SOML, 
SAML, VRFY, NOOP, EXPN, HELP, or TURN; 
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ww) relaying reply to MTAl ; 

xx) jumping to step j) to wait for a new reply; 

yy) jumping to step ddd) if reply from MTA 0 is not a QUIT; 

zz) relaying the QUIT reply to MTA l ; 

aaa) waiting for 221 reply from MTA l; 

bbb) relaying 221 reply from MTA l to MTA 0; 

ccc) jumping to step a) to wait for a new connection; 

ddd) sending a 500 reply to MTA 0 to signal a syntax error; and 

eee) jumping to step a) to wait for a new connection^.]]., 

wherein t allow represents the results of the testing in step (f); t no filter represents 
the results of the testing in step (bb); t_prevent represents the results of the testing in 
step Cg); topen represents the results of the testing in step (e); t DP represents the 
results of the testing in step (d); t bad from represents the results of the testing in 
step (v); t suspect domain represents the results of the testing in step (w); 
techodomain represents the results of the testing in step (p); t to from represents 
the results of the testing in step (cc); and tforgeddomain represents the results of 
the testing in step (q). 

16) (New) The method of claim 14, wherein the determining comprises checking if the 
IP O is in a allow address database. 

17) (New) The method of claim 14, wherein the determining comprises checking if IP O 
is in a prevent_address database. 
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18) (New) The method of claim 14, wherein the determining comprises checking if IP O 
has a domain name entry DD 0 in a DNS database. 

19) (New) The method of claim 14, wherein the determining comprises checking if the 
real domain DD 0 matches the domain of senderaddress A O and the domain of 
sender address A O is in a suspectdomain database. 

20) (New) The method of claim 14, wherein the determining comprises checking if the 
declared domain D O of MTA 0 does not match the real domain DD 0 and the 
declared domain D O is in the suspect domain database. 
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